<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
Andy !<br> Here is one of the ways to get this to work:-<br><pre>server ipsec.conf:<br>version 2.0 # conforms to second version of ipsec.conf specification<br># basic configuration<br>config setup<br> protostack=netkey<br> nat_traversal=yes<br> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.1.0/24<br> <br>conn road<br> authby=secret<br> pfs=no<br> rekey=no<br> keyingtries=3<br> <br> left=%defaultroute<br> leftsubnet=192.168.1.0/24<br> leftprotoport=17/%any<br> <b>leftid=209.240.239.188</b> # Add a connection identifier for server<br> <br> right=%any<br> rightprotoport=17/%any<br> <b>rightid=@myRW01 </b># Add a connection identifier for the client<br> <br> auto=add<br> <br>client ipsec.conf:<br>version 2.0 # conforms to second version of ipsec.conf specification<br># basic configuration<br>config setup<br> protostack=netkey<br> nat_traversal=yes<br> virtual_private=%v4:192.168.0.0/16<br> <br>conn WFC<br> authby=secret<br> pfs=no<br> rekey=yes<br> keyingtries=3<br> type=transport<br> <br> left=192.168.0.3<br> leftprotoport=17/1701<br> <b>leftid=@myRW01 </b># Add connection identifier for the client<br> <br> right=209.240.239.188<br> rightsubnet=192.168.1.0/24<br> rightprotoport=17/1701<br> <br> <br> <br> auto=add</pre><b>Changes to /etc/ipsec.secrets file on the server<br><br>@myRW01 209.240.239.188 : PSK "somesecretphrase01"<br>@myRW01 192.168.1.2 : PSK "somesecretphrase01"<br></b><br> Hope that helps !<br><br><span style="font-family: Tahoma,Helvetica,Sans-Serif; font-style: italic; font-weight: bold;">-<span style="font-family: Times New Roman,Times,Serif;"> Simon Charles - </span></span><br><br><br><br><br>> Date: Mon, 26 Jan 2009 19:11:21 -0600<br>> From: gohanman@gmail.com<br>> To: users@openswan.org<br>> Subject: [Openswan Users] NAT on both sides<br>> <br>> I'm trying to set up a connection with both ends behind NAT. I must be<br>> missing something because I just cannot get it to work. Set up is like<br>> this:<br>> <br>> openswan server 192.168.1.2<br>> router 1.2.3.4<br>> (internet)<br>> router w/ dynamic ip<br>> openswan client 192.168.0.3<br>> <br>> The router at 1.2.3.4 is passing IP 50, UDP 500, and UDP 4500 to 192.168.1.2<br>> <br>> server ipsec.conf:<br>> version 2.0 # conforms to second version of ipsec.conf specification<br>> # basic configuration<br>> config setup<br>> protostack=netkey<br>> nat_traversal=yes<br>> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.1.0/24<br>> <br>> conn road<br>> authby=secret<br>> pfs=no<br>> rekey=no<br>> keyingtries=3<br>> <br>> left=%defaultroute<br>> leftsubnet=192.168.1.0/24<br>> leftprotoport=17/%any<br>> <br>> right=%any<br>> rightprotoport=17/%any<br>> <br>> auto=add<br>> <br>> client ipsec.conf:<br>> version 2.0 # conforms to second version of ipsec.conf specification<br>> # basic configuration<br>> config setup<br>> protostack=netkey<br>> nat_traversal=yes<br>> virtual_private=%v4:192.168.0.0/16<br>> <br>> conn WFC<br>> authby=secret<br>> pfs=no<br>> rekey=yes<br>> keyingtries=3<br>> type=transport<br>> <br>> left=192.168.0.3<br>> leftprotoport=17/1701<br>> <br>> right=209.240.239.188<br>> rightsubnet=192.168.1.0/24<br>> rightprotoport=17/1701<br>> <br>> auto=add<br>> <br>> As given, when I try to bring up the connection from the client side I get this:<br>> 003 "WFC" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal):<br>> both are NATed<br>> 108 "WFC" #1: STATE_MAIN_I3: sent MI3, expecting MR3<br>> 003 "WFC" #1: received Vendor ID payload [CAN-IKEv2]<br>> 003 "WFC" #1: we require peer to have ID '209.240.239.188', but peer<br>> declares '192.168.1.2'<br>> 218 "WFC" #1: STATE_MAIN_I3: INVALID_ID_INFORMATION<br>> <br>> So both NATs are recognized, but it still objects to the IP mismatch.<br>> <br>> If I add rightid=192.168.1.2 to the client's ipsec.conf, I get this<br>> error on the server side:<br>> Jan 26 19:04:44 key pluto[15093]: "road"[2] 68.112.168.88 #4:<br>> STATE_MAIN_R3: sent MR3, ISAKMP SA established<br>> {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha<br>> group=modp2048}<br>> Jan 26 19:04:44 key pluto[15093]: "road"[2] 68.112.168.88 #4: the peer<br>> proposed: 192.168.1.0/24:17/0 -> 192.168.0.3/32:17/0<br>> Jan 26 19:04:44 key pluto[15093]: "road"[2] 68.112.168.88 #4: cannot<br>> respond to IPsec SA request because no connection is known for<br>> 192.168.1.0/24===192.168.1.2[+S=C]:17/%any...68.112.168.88[192.168.0.3,+S=C]:17/%any===192.168.0.3/32<br>> Jan 26 19:04:44 key pluto[15093]: "road"[2] 68.112.168.88 #4: sending<br>> encrypted notification INVALID_ID_INFORMATION to 68.112.168.88:4500<br>> <br>> I'm honestly not sure if that's any closer. I tried specifying ids on<br>> both ends with @ notation, but that gives the same error as using<br>> rightid=192.168.1.2 (except with ids listed in the error).<br>> _______________________________________________<br>> Users@openswan.org<br>> http://lists.openswan.org/mailman/listinfo/users<br>> Building and Integrating Virtual Private Networks with Openswan: <br>> http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155<br></body>
</html>